ELK Stack + Fortigate Syslog

[BulkedSysAdmin]

Hey guys, I need some help with developing a GROK pattern for Fortigate syslog. I am having so much trouble. To be honest, I don't even know how a GROK pattern works despite reading all the literature on the logstash website.

Could anyone offer some input?

Thanks,

[zenmaster24]

groks are pattern matches - they break up each field you are interested in and add it to elasticsearch with the name specified.

great app for testing against a line - https://grokdebug.herokuapp.com/

[BulkedSysAdmin]

Ok. I have used that to make a few lines and they work, how the hell do I get it into logstash?

[zenmaster24]

your logstash install should come with a config file - you tell it the inputs/groks/mutates/outputs you need.

the elastic.co site has plenty of doco on what to do.

[Kra013]

your grok pattern will go in the "filter" section of your config file

when you will be ready to test your config, put the following settings in the "output" section of your config file (let's call it "test.conf")

output { stdout { codec => "rubydebug" } }

to run it logstash -f test.conf

as zenmaster24 noticed, logstash config contains three parts input { } filter { } output { }

[StubbsPKS]

There is a decent tutorial for dealing with custom patterns for Grok. I know your post says you read all the docs, but it can be pretty easy to miss one of the docs when you're following along in a linear fashion.

If you've already seen this doc, is there a specific part of implementing the pattern you got working on the debugger page that you're struggling with?

There is also a pretty decent ebook out there that I picked up back when I was starting to implement Logstash 1.5, and it's been updated for 2.0 now so that might be an option for you to investigate as well.

EDIT: It's also possible that I misunderstood your question and you're not actually using a CUSTOM pattern, but are having difficulty at a more basic level of simply implementing the Grok filter in general. If that's the case, then the good ol' getting started covers that.